Data Processing Addendum

This addendum forms part of the Terms of Service for Taylor's Fleet Services and describes how we handle personal data that belongs to your business rather than to you. "We" and "us" mean TayTech Innovations LLC; "you" means the customer named on the fleet.

1. Roles

For personal data concerning your renters and your contractors, you are the controller and we are the processor. We process it only on your documented instructions, which are: to provide the fleet-operations service described in the Terms.

If we ever believe an instruction from you breaks applicable data-protection law, we will tell you rather than carry it out. Everyone we allow to process it is bound to keep it confidential.

2. Subject Matter and Duration

Processing lasts as long as your fleet exists in the service. The subject matter is the operation of a vehicle rental fleet; the nature and purpose of processing is storing, organizing and presenting the records that operation produces.

3. Categories of Data Subject

Your renters and your contractors: the information about them that you, they, or the accounts and systems you connect put into the service, such as names, contact details, bookings, work and payments.

We do not process special categories of personal data, and you should not enter any.

4. Subprocessors

We use subprocessors for hosting and storage, email delivery, payments, alert and notification delivery, maps and address lookup, and AI services that read text and images for us, each only for its task. A current list is available on request at the support address. If you object to one, tell us; if we cannot resolve your objection, you may close your fleet without further charge. We remain responsible to you for how our subprocessors handle your data.

5. Security

• Separation. Each fleet's data is kept apart from every other fleet's.
• Encryption. All traffic to the service is encrypted in transit. Storage volumes are encrypted at rest by the hosting provider.
• Access control. Roles inside a fleet are yours to grant and revoke. Provider-side access is limited to the operator of the service, and is used only to support you or to keep the service running.
• Credentials. Passwords are stored only as one-way hashes, which we cannot reverse. Keys for an account you connect are used only for that connection and are left out of your export; to revoke one, disconnect the account here or at the provider.
• Backups. Taken regularly, stored off-site, and test-restored.

6. Assistance

We will assist you in responding to a data subject request, and in any data protection impact assessment or consultation with a supervisory authority that relates to our processing. Export and deletion are available to you directly in the product, which covers most requests without needing us at all.

7. Breach Notification

We will notify you without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting your fleet. The notice will describe what we know at the time: the nature of the breach, the categories and approximate number of records involved, the likely consequences, and what we are doing about it, updated as we learn more rather than delayed until complete.

8. Deletion and Return

On deletion of your fleet, we delete its records from the live service immediately, and from our recovery copy and backups within 30 days, as the Privacy Notice describes. After that they cannot be recovered, so export your data first; the export includes the files you uploaded. The Privacy Notice names the few things kept beyond that window.

9. Audit

You may ask us once in any twelve-month period for the information reasonably necessary to demonstrate compliance with this addendum, and we will answer a security questionnaire in the same period. We do not offer on-site audits or penetration testing of shared infrastructure; where you need assurance beyond what we can provide directly, our hosting provider publishes its own compliance documentation.

10. International Transfers

Data is stored and processed in the United States. If you are subject to a law that restricts transfers out of your jurisdiction, tell us before you sign up: we do not currently offer regional data residency, and it is better that you know that now than later.

Contact

Questions about this document go to the support address shown on the sign-in page and in the in-app guide.